⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
We have not been able to test, simulate or build datasets for it, use at your own risk!
Detect Okta user lockout events
- Type: Anomaly
- Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- Last Updated: 2020-07-21
- Author: Rico Valdez, Splunk
- ID: 62b70968-a0a5-4724-8ac4-67871e6f544d
|T1078||Valid Accounts||Defense Evasion, Persistence, Privilege Escalation, Initial Access|
|T1078.001||Default Accounts||Defense Evasion, Persistence, Privilege Escalation, Initial Access|
`okta` displayMessage="Max sign in attempts exceeded" | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, country, state, city, src_ip | `okta_account_lockout_events_filter`
Associated Analytic Story
How To Implement
This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.
Kill Chain Phase
Known False Positives
None. Account lockouts should be followed up on to determine if the actual user was the one who caused the lockout, or if it was an unauthorized actor.
source | version: 2